Risk appetite
Also known as: Risk tolerance, Acceptable risk level, Risk threshold
Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its strategic objectives. It acts as a boundary for decision-making, helping leadership determine which risks are tolerable and which must be mitigated. This threshold ensures that resource allocation aligns with the company's overall tolerance for potential loss or failure.
In practice
An auditor reviews the formal Risk Appetite Statement to determine if current control gaps result in residual risk levels that exceed management's stated limits. For example, a firm with "zero appetite" for regulatory non-compliance must demonstrate more rigorous auditing and monitoring than one with a higher tolerance for operational experimentation.